feat(runtime-host): persist Gitoxide candidate proofs

[zhiiw]

Summary

• persist operation-bound Gitoxide candidate proofs under the storage-root write owner
• bind receipts to the exact accepted head, helper artifact, request, result blob, path, and execution profile
• recover ref-only publication by replaying the same pure candidate request
• add a real child-process exit/reopen test to the three-platform Gitoxide workflow

This is a stacked rebuild on the assumed-merged apache#3741 + apache#3857 baseline. It does not advance the accepted workspace head or expose a production Write/Edit consumer.

中文说明

本 PR 在新的 apache#3741/apache#3857 基线上重建 durable candidate proof owner。它只把进程内 Gitoxide candidate capability 固化成可重验 receipt，不推进 accepted head，也不接 Desktop/CLI。测试覆盖 receipt 篡改、ref-only 重放，以及真实子进程在 ref 发布后退出再由新进程收敛。

[zhiiw]

Superseded by the rebuilt delivery stack #40 -> #41 -> #42. This extraction PR remains available as implementation and review history; no validated logic was discarded.

中文说明

该 extraction PR 已由从最新 main 重建的组合交付栈 #40 → #41 → #42 替代。这里仍保留实现与审查历史，已验证逻辑没有被丢弃。